User Tools
регистрация_событий_в_linux
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
регистрация_событий_в_linux [2016/04/04 07:11] val |
регистрация_событий_в_linux [2017/11/07 10:17] val [Настройка на обработку сообщений типа local0] |
||
|---|---|---|---|
| Line 2: | Line 2: | ||
| ===== Использование утилиты logger ===== | ===== Использование утилиты logger ===== | ||
| + | |||
| + | * [[Средства программирования shell#Передача сообщений в syslog]] в shell скриптах | ||
| + | |||
| <code> | <code> | ||
| $ logger -t postfix -p mail.info 'Message from postfix' | $ logger -t postfix -p mail.info 'Message from postfix' | ||
| - | </code> | ||
| - | ===== Systemd ===== | + | $ logger -t kernel -p kern.emerg 'Kernel Panic' |
| + | </code> | ||
| + | ===== Systemd journald ===== | ||
| * [[https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs|How To Use Journalctl to View and Manipulate Systemd Logs]] | * [[https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs|How To Use Journalctl to View and Manipulate Systemd Logs]] | ||
| + | ==== Форматы вывода ==== | ||
| <code> | <code> | ||
| # journalctl -ra | # journalctl -ra | ||
| + | |||
| + | # journalctl --no-pager | ||
| + | |||
| + | # journalctl -o json | ||
| + | |||
| + | # journalctl -o verbose | ||
| + | |||
| + | # journalctl -f | ||
| </code> | </code> | ||
| + | |||
| + | ==== Фильтрация вывода ==== | ||
| + | <code> | ||
| + | # journalctl -ra -u postfix | ||
| + | |||
| + | # journalctl -ra -p err | ||
| + | |||
| + | # man systemd.journal-fields | ||
| + | |||
| + | # journalctl SYSLOG_FACILITY=2 | ||
| + | </code> | ||
| + | |||
| + | ==== Управление ==== | ||
| + | <code> | ||
| + | # man journald.conf | ||
| + | |||
| + | # journalctl --disk-usage | ||
| + | |||
| + | # journalctl --vacuum-size=1G | ||
| + | </code> | ||
| + | |||
| + | ==== Регистрация сообщений, переданных по сети в journald ==== | ||
| + | |||
| + | * [[http://unix.stackexchange.com/questions/83173/receiving-syslog-messages-with-a-systemd-arch-linux|Receiving Syslog messages with a systemd]] | ||
| ===== Сервис rsyslog ===== | ===== Сервис rsyslog ===== | ||
| Line 28: | Line 65: | ||
| root@server:~# chown syslog:adm /var/log/cisco.log | root@server:~# chown syslog:adm /var/log/cisco.log | ||
| - | root@server:~# restart rsyslog | + | root@server:~# service rsyslog restart |
| root@server:~# tail -f /var/log/cisco.log | root@server:~# tail -f /var/log/cisco.log | ||
| </code> | </code> | ||
| - | ==== Регистрация сообщений переданных по сети ==== | + | ==== Регистрация сообщений, переданных по сети ==== |
| <code> | <code> | ||
| root@server:~# cat /etc/rsyslog.conf | root@server:~# cat /etc/rsyslog.conf | ||
| </code><code> | </code><code> | ||
| ... | ... | ||
| - | $ModLoad imudp | + | module(load="imudp") |
| - | $UDPServerRun 514 | + | input(type="imudp" port="514") |
| ... | ... | ||
| </code><code> | </code><code> | ||
| - | root@server:~# restart rsyslog | + | root@server:~# service rsyslog restart |
| </code> | </code> | ||
| + | ==== Передача сообщений на STDIN программы ==== | ||
| + | <code> | ||
| + | root@server:~# cat /etc/rsyslog.conf | ||
| + | </code><code> | ||
| + | ... | ||
| + | module(load="omprog") | ||
| + | |||
| + | local0.* action(type="omprog" binary="/etc/script.sh") | ||
| + | ... | ||
| + | </code><code> | ||
| + | root@server:~# service rsyslog restart | ||
| + | </code> | ||
| ===== Дополнительные материалы ===== | ===== Дополнительные материалы ===== | ||
| - | ==== Генератор отчетов ==== | + | ==== Генератор отчетов logwatch ==== |
| - | [[Сервис MTA#Использование почтовых псевдонимов]] | + | * [[http://ashep.org/2012/monitoring-sistemy-pri-pomoshhi-logwatch/|Мониторинг системы при помощи logwatch]] |
| + | * [[Сервис MTA#Использование почтовых псевдонимов]] | ||
| <code> | <code> | ||
| - | root@server:~# apt-get install logwatch | + | root@server:~# apt install logwatch |
| root@server:~# /etc/cron.daily/00logwatch | root@server:~# /etc/cron.daily/00logwatch | ||
| + | </code> | ||
| + | |||
| + | ==== syslog facility ==== | ||
| + | <code> | ||
| + | 0 kernel messages | ||
| + | 1 user-level messages | ||
| + | 2 mail system | ||
| + | 3 system daemons | ||
| + | 4 security/authorization messages | ||
| + | 5 messages generated internally by syslogd | ||
| + | 6 line printer subsystem | ||
| + | 7 network news subsystem | ||
| + | 8 UUCP subsystem | ||
| + | 9 clock daemon | ||
| + | 10 security/authorization messages | ||
| + | 11 FTP daemon | ||
| + | 12 NTP subsystem | ||
| + | 13 log audit | ||
| + | 14 log alert | ||
| + | 15 clock daemon (note 2) | ||
| + | 16 local use 0 (local0) | ||
| + | 17 local use 1 (local1) | ||
| + | 18 local use 2 (local2) | ||
| + | 19 local use 3 (local3) | ||
| + | 20 local use 4 (local4) | ||
| + | 21 local use 5 (local5) | ||
| + | 22 local use 6 (local6) | ||
| + | 23 local use 7 (local7) | ||
| </code> | </code> | ||
регистрация_событий_в_linux.txt · Last modified: 2024/05/11 15:49 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
